Command Line Option Vulnerability in Python's Webbrowser API
CVE-2026-4519

7HIGH

Key Information:

Vendor: Python Software Foundation
Status: Cpython
Vendor: CVE Published:; 20 March 2026

🔔 Create Python Software Foundation Vulnerability Alert

What is CVE-2026-4519?

The webbrowser.open() API within Python has a vulnerability that allows URL inputs with leading dashes to be processed as command line options by certain web browsers. This issue can lead to unintended command execution. Although recent updates reject such inputs, it is recommended that users sanitize URLs thoroughly before passing them to the API to mitigate this risk. Developers should ensure that leading dashes are removed from URLs to maintain the integrity and security of their applications.